Skip to content
brandefense.io
Request A Demo

Search Ransomware Intelligence

Jump to a group, country, industry or search victims.

#7 of 28 industriesWatch Construction

Construction: Who Is Hitting It.

As of Oct 19, 2026, 1,096 Construction organisations have been listed as ransomware victims on leak sites, 3.4% of all confirmed victims (about 1 in 29). The most active group in this sector is Qilin.

Updated continuously · figures as of Oct 19, 2026
Confirmed victims
1,096
Share of all victims
3.4%
Rank
#7 of 28 sectors
Most active group
Qilin
Most hit country
United States

Victims Posted Per Month.

Confirmed ransomware victims in Construction per month
MonthConfirmed victims
November 20253
December 202516
January 202652
February 202658
March 202648
April 202647
May 202656
June 202655
July 202668
August 202651
September 202634
October 2026 (month in progress)39

Most Active Groups Here

  1. Qilin13912.7% of all victims
  2. Play948.6% of all victims
  3. Akira857.8% of all victims
  4. LockBit 3.0565.1% of all victims
  5. Clop474.3% of all victims

Most Hit Countries In This Industry

  1. USUnited States63858.2%
  2. CACanada696.3%
  3. DEGermany474.3%
  4. GBUnited Kingdom403.6%
  5. AUAustralia252.3%

Latest Victims.

All 1,096 Construction victims →
Latest confirmed ransomware leak-site victims in Construction
VictimClaimed byCountryIndustryData claimedPosted
American Campus
americancampus.com
HelixUSUnited StatesConstructionNot stated
mckenneys
mckenneys.com
Iah6477USUnited StatesConstruction295.9 GB
Smith Douglas Homes
smithdouglas.com
HelixUSUnited StatesConstructionNot stated
Macfarlan Capital Partners
macfarlan.com
PearUSUnited StatesConstruction350 GB
Solar Communications International
rftransparent.com
PearUSUnited StatesConstruction1.4 TB
KD Corp
kdconstruction.us
QilinUSUnited StatesConstructionNot stated
MPI LTDA
mpiengenharia.com
EmperadorBRBrazilConstruction370 MB
[DISCLOSED]Terca
wienerberger.com
RansomHouseATAustriaConstructionNot stated

Sector Briefings For Construction, Every Week.

The Brandefense platform sends a weekly ransomware brief for your sector and region: new groups, new victims among your peers and suppliers.

Request A Demo

Figures as of Oct 19, 2026. Confirmed leak-site claims collected by Brandefense technologies and validated by Brandefense analysts.

Listed on a leak site means a ransomware group has claimed the company; it is not a confirmed breach. To request a correction or removal, contact Brandefense.